Hacked system analysis

[Sajeesh]

Hi All,

Have a question. If some windows system got hacked how can we determine the occurance. Any tool for forensic analysis

Saj

 

[AtlBo]

Maybe this could be a start for You?
LastActivityView - View the latest computer activity in Windows operating system

Good idea here. I might have a look myself.

NVT ERP keeps logs that record activity (thumbs). Great thing is it catches all command-line operatiors. If LastActivityView does that too it would be great. ERP stores the logs in the Program Data folder by default. I have them going all the way back to Jan LOL. I should thank you for reminding me to clean out the folder.

At any rate, you could search the logs for dates and times and process names for some bit of forensics. As for real low down forensics I guess there is nothing like having the file that started the malware episode. Still, if you know anything about what the malware is using in Windows that should help. Oh yeah, check autoruns and scheduled tasks to make sure there isn't anything strange there. That might point you to a file someplace on the system.

Really simple default-deny. The caveat of the program is that you can designate vulnerable processes, which will cause an alert every time anything invokes them. Also, like VoodooShield, command-line operations can be whitelisted and are logged.

Because it's only the one deny, it's flimsy on its own. VS has the cloud and aI, but ERP is for me mostly a good look at command lines when they run and then a heads up on vulnerables. Also a good program to use to default block something if part of a program bothers you or something. It's super light and very cleanly written if you ever want to take a look.

Actually, I did think of something else just now. The logging occurs even with protection off, so that might be something someone would like.

 

[Sajeesh]

Thank you guys. Will try the same.

Last Activity View is good with events like logon and installation. Am looking for real forensic tool. Found one online, how is your feedback OS Forensics.

 

[ispx]

Found one online, how is your feedback OS Forensics

have never played with os forensics but software from passmark software is good & can be trusted as per my experience.

 

[AtlBo]

Last Activity View is good with events like logon and installation. Am looking for real forensic tool. Found one online, how is your feedback OS Forensics.

Also, could you pass on the name of the app you found?

 

[ispx]

Also, could you pass on the name of the app you found?

OSForensics - Digital investigation for a new era by PassMark Software®

22 tools to play with :

22 Popular Computer Forensics Tools [Updated for 2017]

 

[AtlBo]

OSForensics - Digital investigation for a new era by PassMark Software®

Thanks. Wow. Who knows what that does.

Wouldn't it be nice if MS had ever made a program that would check all the systems and then scour through logs to find potential malware abnormalities? Well, I guess we have sfc /scannow and chkdsk LOL.

LoL, Exactly, I find it relatively quite impressive to be honest!

Yeah, they do have a weird way to solving most problems.

Not at all, and who are we to whine and complain?
C'mon Man, at least they are humble enough to give us sfc and chk,
I find it quite heartwarming and charming to be honest.

LOL

 

[ispx]

Wouldn't it be nice if MS had

i have a long list pending since years of, "Wouldn't it be nice if MS had" but aint nobody listening.

Well, I guess we have sfc /scannow and chkdsk LOL.

i know what you mean. chkdsk i can live with but sfc /scannow is a freaking joke. sfc /scannow never fixed nothing for me.

 

[AtlBo]

Edit: Joke indeed, And while Mr. Russovich has shown us all the great Process Explorer in all these years, M$ just clings on to The Minghty Task Manager.
Tell Me Why?

i have a long list pending since years of, "Wouldn't it be nice if MS had" but aint nobody listening.

Um. Well. Err. Let's see. Uh...

Edit->How about this?->Windows is like a college level IQ test for kindergartners. It's so Microsoft that it must be the most brilliant thing I have ever run across in my life. Honestly, I can't believe what I'm looking at most of the time. I cannot see how it could have been done any more Microsoft

Edit 2->or is it a kindergarten IQ test for college level adults? OR?

Edit 3->Wait...it's M-I-C-R-O-S-O-F-T. Of course!

 

[ispx]

How about this?->Windows is like a college level IQ test for kindergartners